Reliability: memory-safety CI — ASan/UBSan runtime build, valgrind on the smoke set, a `PHPC_RUNTIME_ASSERT=1` mode that checks refcount/ownership invariants, and a written memory-model spec the assertions are derived from (lib/AOT/Linker.php, lib/JIT/Builtin/Refcount.php, docs/runtime-semantics.md)

[PurHur]

Category

Foundation: · the recurring defect class · child of #36379

Why

AGENTS.md calls intermittent heap corruption "a recurring defect class" (7/10, 6/10, 3/5 pass rates for the same binary). Wave 1 added and then reverted a destructor path that "broke all user-script AOT compile", found refcounts that never drop in {main}, a GC that segfaulted at 2,000 objects, and an over-aligned __value__ that was UB under optimisation. There is no sanitizer build, no valgrind job, no runtime assertion mode, and no document stating the ownership rules (who addrefs, who delrefs, when a container is separated). Without a spec, every fix is a guess and every gate is a coin flip.

Deliverable

• docs/runtime-semantics.md §Memory model: invariants for __ref__ (who owns a count), boxed temporaries, {main} vs function scope, container separation, string immortality, helper-unit boundaries, GC roots; each invariant numbered.
• PHPC_RUNTIME_ASSERT=1 build mode: __ref__addref/delref/separate and the dtors check the numbered invariants (rc > 0 on delref, no delref of immortal, no write to a shared container) and abort with the invariant number and a PHP-level trace (Add $_GET superglobal support for VM web scripts #16).
• ASan/UBSan: --asan link (Add $_GET superglobal support for VM web scripts #16) + runtime allocations poisoned on free; weekly workflow runs aot-smoke, the differential corpus (--repeat 3) and the Stdlib: pi, angle conversion, log/exp, and float checks #10 soak under ASan; valgrind --error-exitcode=1 on the 9 smoke cases nightly.
• Every memory-safety fix PR must add a differential case marked @differential-repeat: 10.

Done when

• Spec merged; assert mode catches a deliberately injected double-delref in a unit test
• ASan + valgrind jobs green for 7 consecutive days; the Stdlib: pi, angle conversion, log/exp, and float checks #10 soak runs under ASan weekly

[PurHur]

claim: implementer-worker-lane-b — starting this run (lane B tie-break #36397 % 3 == 1; lane overflow: #36143–#36148 closed). Slice 1: docs/runtime-semantics.md numbered memory-model invariants + PHPC_RUNTIME_ASSERT=1 double-delref abort in Refcount.php (unit test). Not claiming 7-day ASan/valgrind streak this run.

[PurHur]

Slice 1 merged: #36505 (12d5770bef)

• Spec: docs/runtime-semantics.md M1–M7
• PHP_COMPILER_RUNTIME_ASSERT=1 / PHPC_RUNTIME_ASSERT=1 → __ref__delref aborts on rc≤0 (PHPC_RUNTIME_ASSERT M1)
• Inject probe (unit test): PHP_COMPILER_RUNTIME_ASSERT_INJECT_DOUBLE_DELREF=1 — RuntimeAssertDelrefAotTest 4/4
• aot-smoke: 9/9
• Remaining Done-when: ASan + valgrind jobs green for 7 consecutive days; soak under ASan weekly (PHP_COMPILER_ASAN=1 link flags are in, no 7-day job yet)

[PurHur]

claim: compile-trust-automation — starting this run (lane B tie-break #36397 % 3 == 1; lane overflow: #36143–#36148 closed/green; north-star5-verify-fast OK). Slice 2: real ASan smoke + valgrind on aot-smoke hello (scripts are stubs today).

[PurHur]

Merged #36714 (Part of #36397)

Slice 2

• PHP_COMPILER_ASAN=1 no longer feeds -fsanitize=* to raw /opt/llvm9/ld (was: -f may not be used without -shared).
• Link via host clang/gcc; script/runtime-assert-asan-smoke.sh + make runtime-assert-asan-smoke.
• Valgrind smoke runs when installed; skips cleanly in the CI image.

Verified

./script/runtime-assert-asan-smoke.sh → OK (ASan-linked hello)
./script/phpunit.sh --filter RuntimeAssertDelrefAotTest → OK (5 tests)
./script/aot-smoke.sh → 9/9 + size gate OK
make north-star5-verify-fast → OK on tip before claim (#36143 still closed/green)

Remaining Done-when: 7-day ASan/valgrind streak + weekly #10 soak under ASan (scheduled host job — not this PR).

[PurHur]

claim: compile-trust-automation — continuing this run (lane B #36397 % 3 == 1). Slice 3 after #36714: extend ASan/valgrind to full aot-smoke set + differential soak harness; local streak artifact (no GHA). Lane overflow note: #36143–#36148 closed.

[PurHur]

Merged: #36721 (Part of #36397)

Slice 3

• Fixed #36719 rename regression: script/runtime-assert/*.sh ROOT is now dirname/../.. (was script/, broke bin/compile.php).
• PHP_COMPILER_ASAN=1 suppresses link -s (AotGcSections::stripAtLink) — stripped ASan metadata → intermittent SIGSEGV.
• Default make runtime-assert-asan-smoke = echo-only (stable under Docker 8g); RUNTIME_ASSERT_ASAN_FULL=1 for 8 inline cases (still flaky under 8g — documented, not restamped).
• test/runtime-assert/STREAK.json ledger stub (empty ≠ pass).

Verified

make runtime-assert-asan-smoke → OK (1/1 mode=echo)
make runtime-assert-valgrind-smoke → skip (no valgrind)
./script/phpunit.sh --filter 'RuntimeAssertDelrefAotTest|AotGcSectionsTest' → OK
./script/aot-smoke.sh → 9/9 + size gate OK

Remaining Done-when: 7 consecutive asan+valgrind streak days on a scheduled host.

[PurHur]

claim: compile-trust-automation — continuing this run (lane B #36397 % 3 == 1). Slice 4 after #36721: M5 separate-before-write assert + streak ledger check/append (empty ≠ pass) + differential-repeat memory case. Lane overflow: #36143–#36148 closed; #36387/#36382 claimed <48h.